App Signing by Google Play: What Changes vs Local Signing

Play App Signing means Google holds your app's signing key and re-signs your uploads for distribution, while you sign your uploads with a separate upload key. This is now the default and largely mandatory path for new apps, replacing the older model of developers managing their own release keystore entirely.

The risk developers underestimate: losing your upload key is recoverable (Google can help you reset it with proof of ownership), but if you opted out of Play App Signing entirely and lose your one signing key, your app may be unrecoverable for future updates.

The fix

Fix: use Play App Signing by default and store your upload key backup somewhere durable — the recovery process for a lost upload key still requires proof you control the account.

The same check runs automatically when you upload your bundle to the AAB analyzer — permissions, SDK fingerprints, and version info in one pass, free.

Keep going

Data Safety generator →

Turns these answers into a Play-ready CSV.

Data Safety guide →

The full method behind the checks.

Short, specific submission fixes.

Run this check on your own AAB

Free analysis, exports when you need them.

Start free See pricing